A written version of the interactive roadmap above — every station, what you'll learn, and a small thing to build — laid out for reading, reference and search.
Foundations Start here
F1. Cloud & Shared Responsibility
Beginner · 50 min
The cloud is someone else's computers, rented by the second and driven by APIs. Learn the service models (IaaS/PaaS/SaaS), regions and availability zones, and the shared-responsibility model — AWS secures the cloud, you secure what you put in it. This framing shapes every later decision.
Skills: IaaS / PaaS / SaaS · Regions & availability zones · Shared responsibility · The AWS console & CLI
Build it: Draw the shared-responsibility line for a web app on EC2 vs on Lambda. Who patches the OS in each case — and why does that matter?
F2. Compute: EC2 & Lambda
Beginner · 65 min
Compute is where code runs. Learn EC2 (virtual machines you manage), Lambda (functions you do not), and the spectrum between — instances, AMIs, instance types, and the serverless tradeoff. Choosing the right compute model is the first big architecture fork on AWS.
Skills: EC2 instances & AMIs · Instance types & sizing · Lambda functions · Servers vs serverless
Build it: A spiky, event-driven workload runs on an always-on EC2 box. Argue for moving it to Lambda — and name one case where you would not.
F3. Storage: S3, EBS & EFS
Beginner · 60 min
AWS has a storage type for every shape of data: S3 (object storage — the backbone of the cloud), EBS (block volumes for instances), and EFS (shared file systems). Learn durability, storage classes, and lifecycle policies. S3 alone underpins a huge fraction of the internet.
Skills: S3 object storage & classes · EBS block volumes · EFS shared files · Durability & lifecycle policies
Build it: Store user uploads cheaply but keep hot files fast. Design the S3 storage classes + lifecycle rules that move cold data to Glacier.
F4. Networking: VPC
Intermediate · 70 min
Every AWS resource lives in a network you define. Learn the VPC — subnets (public/private), route tables, internet and NAT gateways, and security groups vs NACLs. Networking is the most common source of "why can this not reach that?" — master it early and save yourself pain.
Skills: VPC & subnets · Route tables & gateways · Security groups vs NACLs · Public vs private subnets
Build it: Put a database in a private subnet but let it reach the internet for updates. Which gateway and rules make that work securely?
F5. IAM & Identity
Intermediate · 60 min
IAM decides who can do what. Learn users, roles, policies, and the principle of least privilege — plus why roles (temporary credentials) beat long-lived keys. Misconfigured IAM is behind most cloud breaches; getting identity right is the foundation of cloud security.
Skills: Users, roles & policies · Least privilege · Roles vs access keys · Policy evaluation
Build it: A Lambda needs to read one S3 bucket and nothing else. Write the least-privilege role — and explain why you never hard-code keys.
F6. Databases: RDS & DynamoDB
Intermediate · 60 min
AWS runs your databases so you do not have to. Learn RDS (managed relational — Postgres, MySQL) and DynamoDB (managed NoSQL, single-digit-ms at any scale). Understand when each fits and the managed-service tradeoff: less control, far less operational burden.
Skills: RDS (managed SQL) · DynamoDB (managed NoSQL) · Read replicas & Multi-AZ · Managed vs self-run
Build it: A shopping cart needs massive scale and simple key lookups; reporting needs joins. Pick DynamoDB vs RDS for each and justify it.
Core AWS The craft
T1. Serverless
Intermediate · 65 min
Serverless lets you ship logic without managing servers: Lambda for compute, API Gateway for HTTP, and event triggers gluing services together. Learn cold starts, concurrency, and event-driven patterns. Done well, serverless scales to zero and to millions with the same code.
Skills: Lambda + API Gateway · Event triggers · Cold starts & concurrency · Event-driven patterns
Build it: Build a REST endpoint with API Gateway + Lambda + DynamoDB — no servers. Where do cold starts hurt, and how do you mitigate them?
T2. Containers: ECS & EKS
Advanced · 70 min
When you need more control than Lambda, containers fill the gap. Learn ECS (AWS-native orchestration), EKS (managed Kubernetes), and Fargate (serverless containers — no nodes to manage). Understand the tradeoff between operational simplicity and portability.
Skills: ECS orchestration · EKS (managed Kubernetes) · Fargate (serverless containers) · ECS vs EKS tradeoffs
Build it: A team wants Kubernetes without managing control planes or nodes. Which AWS combo gives them that — and what do they give up?
T3. Infrastructure as Code
Advanced · 65 min
Click-ops does not scale or reproduce. Declare your AWS infrastructure in code — CloudFormation (native) or Terraform (multi-cloud) — so it is versioned, reviewable, and repeatable. Learn stacks, state, and drift. On AWS, IaC is not optional at any real scale.
Skills: CloudFormation · Terraform on AWS · Stacks & state · Drift detection
Build it: Provision a VPC + EC2 + security group as code. Someone edits it in the console — how does your next deploy detect and fix the drift?
T4. Observability: CloudWatch
Advanced · 60 min
You cannot operate what you cannot see. Learn CloudWatch — metrics, logs, alarms, dashboards — plus X-Ray tracing across services. Instrumenting for the three pillars (metrics, logs, traces) is what turns a 3am outage from a guessing game into a guided fix.
Skills: CloudWatch metrics & logs · Alarms & dashboards · X-Ray tracing · The three pillars
Build it: A serverless API is intermittently slow. Which CloudWatch metric alerts you, and how does an X-Ray trace pinpoint the slow downstream call?
T5. Messaging: SQS, SNS & EventBridge
Advanced · 60 min
Decoupled systems talk through messages, not direct calls. Learn SQS (queues), SNS (pub/sub fan-out), and EventBridge (event bus with routing). These let services absorb bursts and fail independently — the backbone of resilient, event-driven AWS architectures.
Skills: SQS queues · SNS pub/sub · EventBridge routing · Async decoupling & DLQs
Build it: An order service must trigger email, inventory, and analytics without waiting on any of them. Wire SNS fan-out — and add a DLQ for failures.
T6. CDN & DNS: CloudFront & Route 53
Intermediate · 55 min
Get content close to users and route them well. Learn CloudFront (CDN at the edge — caching, TLS termination) and Route 53 (DNS with health checks and latency/geo routing). Together they make a global app feel local and fail over gracefully across regions.
Skills: CloudFront edge caching · TLS termination · Route 53 DNS routing · Health checks & failover
Build it: Serve a global site fast and survive a regional outage. Put CloudFront at the edge and use Route 53 to route users to a healthy region.
Production Operate & scale
P1. Well-Architected Framework
Advanced · 55 min
AWS distilled decades of hard lessons into six pillars: operational excellence, security, reliability, performance, cost, and sustainability. Learn to run a workload against them — it is the checklist that turns "it works" into "it works well, safely, and affordably."
Skills: The six pillars · Trade-off analysis · Well-Architected reviews · Design principles
Build it: Review a simple architecture against the six pillars. Which pillar is it weakest on, and what one change improves it most?
P2. Security & Compliance
Advanced · 60 min
Security is job zero on the cloud. Learn encryption (at rest with KMS, in transit with TLS), secrets management, network isolation, and the guardrail services (GuardDuty, Config, CloudTrail) that audit and enforce. Defense in depth, not a single wall.
Skills: Encryption (KMS) & TLS · Secrets management · CloudTrail & Config · Defense in depth
Build it: An auditor asks "who accessed this bucket last month, and is it encrypted?" Which services answer both — and how do you prove it?
P3. High Availability & Multi-Region
Advanced · 65 min
Things fail; good architectures survive them. Learn Multi-AZ for zone failures, multi-region for regional disasters, and the RTO/RPO tradeoffs of active-passive vs active-active. Availability is designed in from the start, not bolted on after the first outage.
Skills: Multi-AZ vs multi-region · Active-passive vs active-active · RTO / RPO · Failover & backups
Build it: Your app must survive an entire AWS region going down. Sketch a multi-region design and state its RTO — and what it costs you.
P4. Cost Optimization / FinOps
Advanced · 55 min
The cloud bill is a design output you own. Learn the pricing levers — on-demand vs reserved vs spot, right-sizing, autoscaling, and storage tiering — plus cost visibility tools. FinOps is the discipline of getting the same result for a fraction of the spend.
Skills: On-demand / reserved / spot · Right-sizing · Cost Explorer & budgets · Storage tiering
Build it: A dev environment runs 24/7 but is used 8 hours a day. List three changes that cut its bill by more than half.
P5. Auto-scaling & Load Balancing
Advanced · 55 min
Match capacity to demand automatically. Learn Elastic Load Balancing (ALB/NLB) to spread traffic and Auto Scaling groups to add/remove instances on metrics. Together they deliver the cloud's core promise: handle a traffic spike without paying for idle capacity off-peak.
Skills: ALB vs NLB · Auto Scaling groups · Scaling policies & metrics · Health checks
Build it: Traffic 10x's at noon and drops at night. Configure an ALB + scaling policy that adds instances on CPU and removes them when quiet.
P6. DevOps on AWS
Advanced · 55 min
Ship changes safely and often. Learn the CI/CD toolchain (CodePipeline, CodeBuild, CodeDeploy), blue-green and canary deploys, and integrating IaC into the pipeline. The goal is boring, reversible releases — deploy on every merge without holding your breath.
Skills: CodePipeline / CodeBuild / CodeDeploy · Blue-green & canary · Pipeline + IaC · Rollbacks
Build it: Design a pipeline that builds, tests, and deploys to a canary before full rollout — and rolls back automatically if error rate spikes.